Problem description
The vulnerability scan reports "Content Security Policy Contains unsafe-* Directive" on the Nextcloud SAML login selection page:
/index.php/apps/user_saml/saml/selectUserBackEnd
After reviewing the response headers, the issue appears to be caused by the CSP generated by the application itself, most likely Nextcloud or the user_saml app, and not by the Apache web server configuration.
The relevant part of the delivered Content Security Policy contains:
script-src 'nonce-...' 'strict-dynamic'script-src-elem 'strict-dynamic' 'nonce-...'style-src 'self' 'unsafe-inline'
The scan is triggered because unsafe-inline is present in the style-src directive.
Why this is an issue
The use of unsafe-inline weakens the protection normally provided by a Content Security Policy.
In this specific case, the problem affects inline styles, because the application currently allows:
style-src 'self' 'unsafe-inline'
Problem description
The vulnerability scan reports "Content Security Policy Contains
unsafe-*Directive" on the Nextcloud SAML login selection page:/index.php/apps/user_saml/saml/selectUserBackEndAfter reviewing the response headers, the issue appears to be caused by the CSP generated by the application itself, most likely Nextcloud or the
user_samlapp, and not by the Apache web server configuration.The relevant part of the delivered Content Security Policy contains:
script-src 'nonce-...' 'strict-dynamic'script-src-elem 'strict-dynamic' 'nonce-...'style-src 'self' 'unsafe-inline'The scan is triggered because
unsafe-inlineis present in thestyle-srcdirective.Why this is an issue
The use of
unsafe-inlineweakens the protection normally provided by a Content Security Policy.In this specific case, the problem affects inline styles, because the application currently allows: